Privacy Policy
In short. Paste Pro keeps your clipboard history on your computer. When you turn on sync, your clips are encrypted on your device first, so neither we nor the cloud you choose can read them. We do not run analytics or advertising, and we do not sell personal data. The few things we do hold are listed below, with how long we keep them and how to have them deleted.
1. Who we are
Paste Pro is made by TechieBro Media, Hyderabad, Telangana, India (“we”, “us”). We decide how and why your personal data is processed: we are the data controller under the EU General Data Protection Regulation (GDPR) and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Contact for anything in this policy, including our Grievance Officer: [email protected].
2. What this policy covers
The Paste Pro app, our sync and licensing service at api.pastepro.app, and our website at pastepro.app.
3. On your computer
Everything you copy, the collections you make, your notes and your settings are stored in Paste Pro's folder on your computer. They stay there unless you turn on sync or export them. The history file is protected by your computer's user account and, on a Mac, by FileVault if you have turned it on. Paste Pro does not add a separate layer of encryption to it.
- Sensitive clips. Things that look like passwords, keys or card numbers are kept on this computer only and never sync. By default they are hidden in the list and deleted automatically after a minute; you can turn either off in Settings → Privacy, and they still never leave this computer. Copies made by password managers and other apps you choose to ignore are never stored.
- Permissions you grant. Accessibility (to paste for you), Microphone and Speech Recognition (for voice notes, transcribed on your Mac), Notifications (for reminders), and Open at Login. You can turn each of them off in System Settings.
- Apple Intelligence features run on your Mac. Nothing you send to them leaves your computer.
- Link previews (on by default; Settings → Privacy). When you copy a web address, Paste Pro fetches that page from your computer to show its title and picture. The website sees your IP address, as it would if you opened the link. No cookies or referrer are sent, and only public addresses are contacted.
- Update check (on by default; Settings → About). Once a day, Paste Pro asks pastepro.app for the latest version number. The request carries nothing about you or your clips; our server sees your IP address, as with any web request, and does not keep it. When you choose to install an update, the app downloads it from GitHub (github.com, which sees your IP address like any download) and checks its signature before installing.
- No analytics. The app sends no usage statistics, crash reports or advertising identifiers.
4. Sync (only if you turn it on)
Before any clip leaves your computer it is encrypted end to end (XChaCha20-Poly1305 with keys kept in your system keychain). Only your own devices can decrypt it. Whichever place you choose stores encrypted data it cannot read.
| You choose | What is stored there | Who runs it |
|---|---|---|
| iCloud | Your encrypted history in your private iCloud database. The sync key goes in iCloud Keychain. | Apple, under your iCloud agreement with Apple. |
| Google Drive | Your encrypted history in Paste Pro's hidden app folder in your Drive, and your account key encrypted under the recovery code you are shown. Paste Pro asks Google for access to that app folder only, and for your email address, to show which account is connected. The Google sign-in token is kept in your keychain. | Google, under your Google account terms. Disconnecting does not delete the folder; you can remove it in your Google Account under “Third-party apps with account access”. |
| Paste Pro Cloud (api.pastepro.app) | Your encrypted history and shared spaces; your devices' public keys and encrypted key copies; an account number; storage used; and when things were created. No name or email is attached to a sync account. | Us, on our hosting provider's servers. |
Shared spaces work the same way: everything is encrypted for the members. We see only that the space exists, how large it is, and which account numbers belong to it.
5. Licence keys
If you receive or buy a Paste Pro key, we keep a licence record at api.pastepro.app:
- your email address, the plan (Free, Pro with its end date, or Lifetime), and when the key was made;
- for each computer that uses the key, a random computer id made by the app (not linked to your sync account or your device's name), and when it first and last checked in.
When you add a key, the app sends the key and that random id to api.pastepro.app to turn the key on, and checks in about once a day while online. That is how the five-computer limit for Lifetime works and how a change to your plan reaches the app. Nothing else is sent.
Your licence key does not contain your email address; it is kept only in our licence record. Treat the key like a password all the same, and do not post it publicly: anyone holding it can use one of its computer places.
6. Our website
The website sets no cookies and runs no analytics. To show its typefaces and run its page, your browser loads files from Google Fonts (Google) and from the public code libraries cdnjs (Cloudflare), unpkg, jsDelivr and the Tailwind CDN. Those providers receive your IP address and browser details when they send the files.
7. Emails
We send email only for the purposes below, as plain text with no tracking pixels or tracked links.
- The beta list. If you enter your email on our website and tick the box, we email you a link to confirm it. Unconfirmed addresses are deleted after 7 days. Once confirmed, we keep your address until we invite you to the beta and then for 12 months, or until you leave the list using the link in every email from it, whichever comes first. We use it only to send you an invite. A beta invite is a Pro licence key, which we file under your email like any other key (section 5), with a link to download the app.
- Invites. When we invite you, we keep your email with the invite so we can tell you if it is withdrawn. Sync accounts themselves still have no email.
- Licence keys. We email you your key, and tell you when its plan changes or it is deleted.
- Privacy requests (section 13): we email you to confirm the request, and then with the answer.
Emails go out through Hostinger's mail service. Hostinger keeps a copy of each sent message only until our service deletes it, within seconds of sending. A log of what we sent (address, subject, time, whether it was delivered, never the message itself) is kept for 30 days.
8. Payments
We are not taking payments at the moment. If we start, card details will be handled by our payment provider, never by us. We will name the provider here before then.
9. Why we use your data (legal bases)
| Purpose | Data | GDPR basis | DPDP Act basis |
|---|---|---|---|
| Syncing your encrypted history and spaces | Sync account data (section 4) | Contract (Art. 6(1)(b)) | Your consent, given by turning sync on (s. 6); data you provide voluntarily for the purpose (s. 7(a)) |
| Licences, plans and the computer limit | Email, plan, computer ids (section 5) | Contract (Art. 6(1)(b)) | Consent and voluntary provision (s. 6, s. 7(a)) |
| Keeping the service safe: rate limits, abuse and fraud prevention, records of admin actions | IP address (in memory only), admin action logs | Legitimate interests (Art. 6(1)(f)) | Legitimate uses, including compliance with law (s. 7) |
| The beta list | Your email | Consent (Art. 6(1)(a)), given by ticking the box and confirming | Consent (s. 6) |
| Invites and licence emails | Your email | Contract (Art. 6(1)(b)) | Voluntary provision for the purpose (s. 7(a)) |
| Answering your requests and complaints, and keeping a record that we did | Your email, what you asked, and when and how we answered | Legal obligation (Art. 6(1)(c)) and legitimate interests | Legitimate uses, including compliance with law (s. 7) |
You can withdraw consent at any time by turning sync off, removing your key, leaving the beta list, or asking us to delete your data. Withdrawal does not affect what happened before it.
10. How long we keep it
- Synced data at api.pastepro.app: while your sync account exists. Clips you delete are removed from your devices; encrypted copies at api.pastepro.app are removed when the account is deleted.
- Licence record and computer list: while the licence exists. Computers you remove are deleted at once.
- IP addresses: held in memory for rate limiting only, for minutes, and never written to our database. Our hosting provider may record standard server logs (IP address, time, request) for security; we keep those no longer than 30 days.
- Records of admin actions (which admin changed what, without your email): up to one year.
- The beta list: as in section 7, at most 12 months after your invite. Email log: 30 days.
- Privacy requests: unconfirmed requests are deleted after 7 days. Once we answer, we keep the record (your email, what you asked, when and how we answered) for two years, to show we handled it.
- Data on your computer: until you delete it (Settings → About → Erase this Mac) or uninstall Paste Pro.
11. Who receives it
We do not sell or rent personal data, and we do not share it for advertising. It is processed by:
- Railway Corporation, which hosts pastepro.app, api.pastepro.app and their database (encrypted data, licence records, the beta list and request records) under its data-processing agreement;
- Cloudflare, which carries traffic to pastepro.app and api.pastepro.app and protects them from attacks, and so sees IP addresses and requests;
- Hostinger, which sends our emails (section 7) and so sees the address, subject and text of each one;
- GitHub, which hosts the app's downloads:
pastepro.app/releasessends you to GitHub for the file, so GitHub sees that download's IP address and request; - Apple and Google, only if you choose iCloud or Google Drive sync (encrypted data only, in your own account);
- the website providers named in section 6;
- authorities, if the law requires it. We can only ever hand over encrypted clips we cannot read.
12. International transfers
We are based in India. Our servers and database run with Railway in Singapore, and our other providers may be in other countries. For people in the EU or EEA, we transfer data outside it where it is necessary to provide the service you asked for (GDPR Art. 49(1)(b)), and we rely on our providers' standard contractual clauses where they offer them. Your clips are encrypted before they leave your device in every case.
13. Your rights
You can ask us to:
- see the personal data we hold about you and how we use it;
- correct or complete it;
- delete it: your sync account, your licence record, or both;
- receive it in a portable format (your clips can be exported any time in Settings → Backup);
- object to or restrict processing based on legitimate interests;
- withdraw consent;
- under the DPDP Act, nominate someone to exercise these rights if you die or become unable to.
Use the form at pastepro.app/privacy-request for a copy of your data or its deletion: we email you a link to confirm it is your address, then answer within 30 days. For anything else, email [email protected]. Synced clipboard history carries no email, so we cannot find it from your address: to have it deleted from our server, write to us with the device id shown in Settings → About → This device, and we erase that sync account. Sign out in the same place removes your history from that computer only. We may ask you to show you hold the key or device concerned, so we never act on someone else's data.
14. Complaints
Please write to our Grievance Officer at [email protected] first; we aim to resolve complaints within 30 days. In India, if you are not satisfied, you may complain to the Data Protection Board of India. In the EU or EEA, you may complain to your local data-protection authority.
15. Security
Clips are encrypted end to end; keys are kept in your system keychain and never sent to us; every request to api.pastepro.app is signed by your device; and admin access is limited and logged. If a personal-data breach affects you, we will tell you and the relevant authorities within the time the law requires (72 hours where it applies).
16. Children
Paste Pro is for people aged 18 or over. We do not knowingly process the personal data of anyone under 18. If you believe a child has given us data, write to us and we will delete it.
17. Changes
If we change this policy, we will update the date at the top and, for significant changes, tell you in the app before they take effect.